Product Support Notice

Transcription

1 PSN # PSN004621u Product Support Notice 2016 Avaya Inc. All Rights Reserved. Original publication date: 22-Dec This is Issue #03, published date: Severity/risk level Medium Urgency When convenient 20-May Name of problem Avaya Aura Application Enablement (AE) Services Super Patch 5 Release Notes Products affected Avaya Aura Application Enablement (AE) Services Release (all offer types) Problem description What is fixed in this Patch? In keeping with NIST guidelines and industry best practices, Avaya is rotating the security keys associated with remote maintenance access through the Avaya Security Gateway (ASG). In order to complete the process, you need to obtain and install a new ASG authorization file. The instructions, to replace the authorization file, are specified in the AE Services implementation/installation guide documentation for each offer type under the section called Reinstalling or replacing the Avaya Access Security Gateway default authentication file. (Issue AES-14585) The information related to this issue for the System Platform domain s (dom0 and udom) is available in PSN027026u. For all users that do not already have the AE Services Linux Security Update Patch 4 installed, this Super Patch should be installed after the Linux Security Update Patch 4, or its security updates, specified under PSN is installed. This patch contains the following updates to the DMCC Service: Issue AES-14630: When a call, that has User-to-User Information (UUI) associated with it, adds a party to the call, the ConferencedEvent contains the UUI of the first call, instead of the conferenced call in the UserData parameter. The Original Call Information (OCI), in the private data section of the ConferencedEvent, contains data for the first call where the UserData parameter is null. This is misleading in that both UserData parameters are associated with the call before the call was conferenced. With this patch, the UUI will now be set in the OCI private data UserData parameter. The UUI will remain in the UserData parameter of the main part of the ConferencedEvent to preserve backward compatibility for existing applications. Issue AES-14657: AE Services provides an administration option to apply dial plan conversion rules for non-normalized TelURI numbers it receives from Lync for Remote Call Control (RCC) integrations. Skype for Business changed what is sent to AE Services for non-normalized TelURI numbers. This caused breakage in AE Services when the administration option is enabled. With this patch, AE Services will apply the dial plan rules to non-normalized TelURI numbers from Skype for Business integrations. NOTE: Skype for Business is not supported by AE Services. Issue AES-14517: In some cases, when registering a DMCC station, if the client application goes off-hook, or gets Button Information or gets Lamp Mode too soon, then the Q931 signaling socket may not be set-up correctly. This can result in the station being unregistered by Communication Manager within a few minutes. This patch solves this issue, ensuring that the station stays registered. Issue AES-14625: After an AE Services GRHA fail-over, if the newly-active AE Services server cannot access the WebLM server, then each subsequent new DMCC station registration takes approximately 5 seconds to complete. This patch fixes this slow registration scenario, enabling the client application to register DMCC stations at the normal rate. Issue AES and AES-14512:

2 For an uncontrolled fail-over of a duplex Communication Manager, DMCC failed to re-establish the DAPI link connection. If a station registration request was received during this period, DMCC would detect the invalid link state and not issue the registration request to Communication Manager. With this patch, DMCC will now attempt to re-establish the DAPI link connection to Communication Manager. In addition, DMCC will issue a station registration request to Communication Manager regardless of the DAPI link state. This patch contains the following updates to the TSAPI Service: Issue AES-14641: AE Services does not send a "Connection Cleared" event to the application over a device monitor of a bridged extension if the VDN involved in a call is also being monitored. In a conference call scenario involving an external number and two bridged extensions associated with the same principle extension when the conferencing bridged extension is the last party to drop off the call, AE Services does not send a Connection Cleared event report over the device monitor of the conferencing bridge extension if the call also has an active VDN monitor. Issue AES-14640: There was a problem where a call was made to an external number and a monitor was added to the call. If multiple attempts were made to seize a trunk for the call, before and after the monitor for the call was added, a NETWORK_REACHED event was not always sent for the call monitor. With this patch, a NETWORK_REACHED event will be sent to the monitor for the call when a trunk is seized. This patch contains the following updates to the Transport Service: Issue AES-14387: If an AEP connection was lost when traffic was running, there was a race condition which could cause the transport service to get stuck in an infinite loop. This eventually led to a mutex time out, which would cause the transport service to reset and all CTI associations to be lost. This patch contains the following updates to the ASAI Service: Issue AES-14632: This patch fixes a problem which could cause invalid characters to be populated in the wide character VDN Name field associated with Lookahead Interflow in the Offered or RouteRequest CTI messages. This patch contains the following updates to the AE Services Management Console: Issue AES-14656: On the AE Services Management Console screen, Communication Manager Interface > Switch Connections > Survivability Hierarchy, any accidently entered leading or trailing white spaces were being accounted as part of the Processor Ethernet (PE) IP address field. This patch solves this issue by removing the unnecessary spaces once the screen is submitted. This patch contains the following updates to the SMS Service: Issue AES-14426: This patch adds "Service Level Target Seconds" to the list of fields from the Communication Manager SAT screen "list/display huntgroup" that can be accessed via the AE Services System Management Services (SMS). This patch contains the following updates to the AE Services Server: Issue AES-14696: If GHRA is enabled on an AE Services server, the LDAP service is restarted every 2 minutes. In addition, the LDAP service is restarted whenever a customer takes a backup of AE Services configuration. In either case, it is possible that the AE Services client application session may fail to establish a connection because the LDAP service is restarting during that time. This patch fixes this issue. Issue AES-14447: 2016 Avaya Inc. All Rights Reserved. Page 2

3 Newly added LDAP users (used for CTI authentication) don t get ported over to the AE Services stand-by server. This issue is specific to AE Services servers running AE Services SuperPatch 4. If GRHA is enabled on the AE Services server, an LDAP user added to the active AE Services server is not propagated to the standby AE Services server. Therefore in the event of a failover, the newly added LDAP user would not be present on the newly active AE Services server. In addition, if an AE Services server backup taken from an AE Services SuperPatch 4 system is restored on a newer AE Services server, the LDAP data in the backup will not be restored to the AE Services server. This patch fixes this issue. Issue AES-14543, AES-14645, AES-14680: This patch applies some minor WebLM updates. Issue AES-14585: In keeping with NIST guidelines and industry best practices, Avaya is rotating the security keys associated with remote maintenance access through the Avaya Security Gateway (ASG). In order to complete the process, you need to obtain and install a new ASG authorization file. The instructions to replace the authorization file are specified in the AE Services implementation/installation guide for each offer type under the section called Reinstalling or replacing the Avaya Access Security Gateway default authentication file. Issue AES-14672: Apply a minor tomcat security fix. Issue AES and AES-14452: This change is an enhancement to improve the management of the AE Services Trusted Certificate Authority (CA) file and cleanup of the CA directory. Issue AES-14417: The time format used by the AE Services SNMP agent to acquire the CPU usage data, in association with the Linux sar command, was using a hourly based time format of 1-12 instead of The daily performance data for the sar command is based on the 0-23 hour format. This patch fixes this issue. Issue AES-14637: The AE Service s syslogreader service logging feature will be updated by the patch to perform log rotation and limit the maximum number of generated log files. Issue AES-14147: The HMDC component has been updated to use SNMPv3 for all internal data collection operations. This fixes an issue where the HDMC component was not able to collect and store historical metric data for the DMCC and TSAPI services locally on the AE Services server. Resolution Install Super Patch 5 for AE Services Workaround or alternative remediation n/a Remarks 1. What AE Services rpm/s is updated by AE Services Super Patch 5? aesvcs-install-scripts-hooks noarch.rpm aesvcs-linux-config noarch.rpm aesvcs-tomcat-config noarch.rpm aesvcs-platform noarch.rpm aesvcs-alarmservice-config noarch.rpm aesvcs-userservice-config noarch.rpm aesvcs-sms noarch.rpm aesvcs-callcontrol i386.rpm 2016 Avaya Inc. All Rights Reserved. Page 3

4 aesvcs-snmp noarch.rpm aesvcs-hmdc noarch.rpm aesvcs-watchdog-config noarch.rpm asgtools-aes-2-0.av09.i386.rpm sohd aes.i386.rpm eject el5.i386.rpm 2. Are there new features or enhancements included in AE Services Super Patch 5? No. 3. What must application suppliers do to be compatible with AE Services Super Patch 5? (recompile, re-link, etc.) This Super Patch is fully compatible with AE Services Clients and SDKs. 4. Is applying AE Services Super Patch 5 service affecting? The AE Services server will be out of service for 20 to 30 minutes while the patch is being applied. 5. With which Application Enablement Services release(s) is AE Services Super Patch 5 compatible? This patch is compatible with all AE Services offer types. 6. Is the AE Services Super Patch 5 cumulative? Yes, this patch includes the fixes provided by the previous AE Services patches. 7. Is the AE Services Super Patch 5 compatible with Application Enablement Services and earlier servers? No. The AE Services Super Patch is only supported with AE Services Is the AE Services Super Patch 5 available for all Offer Types? Yes. Please use the appropriate procedure for the upgrade, i.e. via the Patch Management menu in the web console of the System Platform for Virtual Appliance offer and directly on the AE Services server for Bundled, VMware or Software Only. 9. What are the CM requirements for the Application Enablement Services Super Patch 5? AE Services supports CM 6.x and later. Certain functionality on AE Services requires CM versions up to and including CM 6.3 FP4. Patch Notes The information in this section concerns the patch, if any, recommended in the Resolution above. Backup before applying the patch Please take a backup of the AE Services server data before applying the AE Services Super Patch 5. Follow these steps to back up the AE Services server data: 1. Login to the AE Services Management Console using a browser. 2. From the main menu, select Maintenance Server Data Backup. AE Services backs up the database, and displays the Database Backup screen, that displays the following message: The backup file can be downloaded from Here. 3. Click the "Here" link. A file download dialog box is displayed, that allows you to either open or save the backup file (named as: servername_rsoftwareversion_mvapdbddmmyyyy.tar.gz, where ddmmyyyy is a date stamp). 4. Click Save, and download the backup file to a safe location that the upgrade will not affect. For example, save the file to your local computer or another computer used for storing backups. Download To download the AE Services patch, go to: 2016 Avaya Inc. All Rights Reserved. Page 4

5 A. Avaya Support ( On the Downloads screen, in the textbox labeled Enter Product Name, enter Avaya Aura Application Enablement Services and the release option 6.3.x. If the option Select a content type is displayed select the Download radio button and click the button labeled Enter. If the Documents table is displayed, select the link, View downloads, on the right-hand side of the screen above the Documents table. In the Downloads table locate and select the entry, Avaya Aura Application Enablement Services Super Patch 5 (new entries are inserted at the top of the list). B. PLDS ( Select View Downloads. Use the search engine to locate the available downloads for Application Enablement Services using version 6.3 to narrow the search. Locate the entry, Avaya Aura Application Enablement Services Super Patch 5 (new entries are inserted at the end of the list). Alternatively, you can search for the Download ID, which is AES All AE Services Software Downloads are now in PLDS, while the Release Notes documents are provided on the Support Site. There will be cross references between the corresponding download entries for patches. File Name File Size MD5 Sum 633_SuperPatch_5.zip MB (141,042,494 Bytes) 9dc1d325415e1dc94a582f97ebf9ac63 Before you start with the installation of the Patch, check the md5 checksum of the file. Run the following from the command line: md5sum 633_SuperPatch_5.zip If the MD5 checksum does not match what is stated above, do not proceed with the installation of the patch. Download the patch again and check the MD5 checksum again. Patch install instructions How to check the detailed AE Services version Service-interrupting? Yes A. For the AE Services on System Platform offer, use the System Platform Management Console (and hence see whether the patch has been applied already): 1. Login to the System Platform Management Console using a browser. 2. Go to Virtual Machine Management Manage (that is the page which should come up after connecting to the web console) 3. Verify that your AE Services VM has AE Services running (the GA version shows ) 4. Click on that version information to get the detailed version information in a popup window. 5. If the patch is not listed, continue to the next section, How to install the Super Patch to the AE Services server. When multiple patches for the AE Services server is installed, the System Platform Management Console may show each of the installed patches as Active instead of only showing the latest installed patch as Active and the previous installed patches as Installed. While other VM s may use a patch status consisting of Active, Installed and Uninstalled, AE Services currently only use the patch status Active and Uninstalled. B. For the Bundled, VMware and Software Only offer, use the AE Services Linux console (and hence see whether the patch has been applied already): 1. Start a Linux console session on the AE Services server (locally, via service port, or remotely using e.g. putty or SSH) 2016 Avaya Inc. All Rights Reserved. Page 5

6 2. As the root user, execute the following command: swversion 3. If the patch is not listed, continue to the next section, How to install the Super Patch to the AE Services server. How to install the Super Patch to the AE Services server. A. Patch Installation Instructions for the AE Services on System Platform offer 1. On the System Platform (SP) Management Console, click on Server Management Patch Management Download/Upload 2. Choose the source of the patch (PLDS, HTTP, SP, devices on SP, or local to your PC). 3. After it has been uploaded to SP, click on Manage (from the Patch Management menu). Now you will see the available patch waiting for installation below the caption AES. 4. Once you re ready, click on the PatchID link, finally on the Install button. 5. Follow the on-screen instructions. B. Patch Installation Instructions for the Bundled, VMware or Software Only offer: 1. Start a Linux console session on the AE Services server (locally, via service port, or remotely using e.g. putty or SSH) 2. Secure copy 633_SuperPatch_5.zip to the /tmp directory on the AE Services server. 3. As the root user, execute the following from the command line: cd /tmp update -u --force 633_SuperPatch_5.zip 4. Follow the on-screen instructions. After applying the Super Patch, reboot the AE Services server. A. For the AE Services on System Platform offer 1. On the System Platform Management Console, click on Virtual Machine Management Manage. 2. On the Manage Virtual Machines page, click on Application Enablement Services 3. On the Application Enablement Services page, click on Reboot B. For the Bundled, VMware or Software Only offer As the root user execute the following command from the command line: shutdown r now Post Patch Installation Verification: 1. Start a Linux console session on the AE Services server (locally, via service port, or remotely, using e.g. putty) 2. Login as sroot or root 3. Run the following command to verify the installation of Super Patch 5: swversion The swversion command should return something similar to the following if Super Patch 5 is installed: ************* Patch Numbers Installed in this system are ************* ==== 5 ==== In case you used swversion -a, the RPMs will be listed as well below the patch number this is the output: ************* Patch Numbers Installed in this system are ************* 2016 Avaya Inc. All Rights Reserved. Page 6

7 ==== 5 aesvcs-install-scripts-hooks noarch.rpm aesvcs-linux-config noarch.rpm aesvcs-tomcat-config noarch.rpm aesvcs-platform noarch.rpm aesvcs-alarmservice-config noarch.rpm aesvcs-userservice-config noarch.rpm aesvcs-sms noarch.rpm aesvcs-callcontrol i386.rpm aesvcs-snmp noarch.rpm aesvcs-hmdc noarch.rpm aesvcs-watchdog-config noarch.rpm asgtools-aes-2-0.av09.i386.rpm sohd aes.i386.rpm eject el5.i386.rpm ==== Instead of the steps 1-3 as listed above, you can use the same procedure as described at the beginning of this section for AE Services on System Platform (which does not require a console login). 4. Login to the AE Services Management Console using a browser. 5. From the main menu, click Status. 6. On the Status page, verify that all previously licensed services are running. 7. Validate the server configuration data, as follows: From the main menu, click Networking. Under AE Service IP (Local IP), verify that the settings are correct. Under Network Configure, verify that the settings are correct. Under Ports, verify that the settings are correct. 8. Check all of the remaining Management Console pages listed under AE Services and Communication Manager Interface. Verify that the information is complete and correct. This completes the installation of the Super Patch. Follow this procedure only if the AE Services server configuration data has changed. Follow this procedure to restore the AE Services server data: 1. From the main menu of the AE Services Management Console, select Maintenance Server Data Restore. The Management Console displays the Restore Database Configuration screen. The initial state of the Restore Database page provides you with two basic functions: Text box with the Browse button, which provides the means to select a backup file to use for the Restore process. Alternatively, you can type a fully qualified name of the backup file in the text box. Restore button, that starts the Restore process 2. Click Browse and locate the AE Services database backup file that you intend to use (For example: servername_r _mvapdb tar.gz). 3. Click Restore. The Management Console redisplays the Restore Database Configuration page, with the following message. "A database restore is pending. You must restart the Database Service and the AE Server for the restore to take effect. To restart these services now, click the Restart Services button below." 4. Click Restart Services. AE Services restarts the Database Service and the AE Services, thereby completing the Restore 2016 Avaya Inc. All Rights Reserved. Page 7

8 process. Verification See the Post Patch Installation Verification section above. Failure n/a Patch uninstall instructions Follow the Patch Uninstall Instructions: A. Patch Uninstall Instructions for the AE Services on System Platform offer: 1. On the System Platform Management Console, click on Server Management Patch Management Manage. Now you will see the installed patch as active. When multiple patches for the AE Services server is installed, the System Platform Management Console may show each of the installed patches as Active instead of only showing the latest installed patch as Active and the previous installed patches as Installed. While other VM s may use a patch status consisting of Active, Installed and Uninstalled, AE Services currently only use the patch status Active and Uninstalled. 2. Click on the PatchID link, finally on the Remove button. 3. To also remove the patch file itself, click on the Remove Patch File button (optional). B. Patch Uninstall Instructions for the Bundled, VMware or Software Only offer: 1. Start a Linux console session on the AE Services server (locally, via service port, or remotely using e.g. putty or SSH). 2. As the root user, execute the following from the command line: update -e 5 3. Follow the on-screen instructions. Follow this procedure to restore the AE Services server data using the backup data saved during the patch install process: 1. From the main menu of the AE Services Management Console, select Maintenance Server Data Restore. The Management Console displays the Restore Database Configuration screen. The initial state of the Restore Database page provides you with two basic functions: Text box with the Browse button, which provides the means to select a backup file to use for the Restore process. Alternatively, you can type a fully qualified name of the backup file in the text box. Restore button, that starts the Restore process 2. Click Browse and locate the AE Services database backup file that you intend to use (For example: servername_r _mvapdb tar.gz). 3. Click Restore. The Management Console redisplays the Restore Database Configuration page, with the following message. "A database restore is pending. You must restart the Database Service and the AE Server for the restore to take effect. To restart these services now, click the Restart Services button below." After removing Super Patch 5 and scheduling the restore, reboot the AE Services server. A. For AE Services on System Platform 1. On the System Platform Management Console, click on Virtual Machine Management Manage. 2. On the Manage Virtual Machines page, click on Application Enablement Services 3. On the Application Enablement Services page, click on Reboot B. For the Bundled, VMware or Software Only offer As the root user, execute the following command from the command line: shutdown r now 2016 Avaya Inc. All Rights Reserved. Page 8

9 Do I have to perform any additional steps if I am uninstalling the Super Patch? No. Security Notes The information in this section concerns the security risk, if any, represented by the topic of this PSN. Security risks n/a Avaya Security Vulnerability Classification Not Susceptible Mitigation n/a If you require further information or assistance please contact your Authorized Service Provider, or visit support.avaya.com. There you can access more product information, chat with an Agent, or open an online Service Request. Support is provided per your warranty or service contract terms unless otherwise specified in the Avaya support Terms of Use. Disclaimer: ALL INFORMATION IS BELIEVED TO BE CORRECT AT THE TIME OF PUBLICATION AND IS PROVIDED AS IS. AVAYA INC., ON BEHALF OF ITSELF AND ITS SUBSIDIARIES AND AFFILIATES (HEREINAFTER COLLECTIVELY REFERRED TO AS AVAYA ), DISCLAIMS ALL WARRANTIES, EITHER EXPRESS OR IMPLIED, INCLUDING THE WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE AND FURTHERMORE, AVAYA MAKES NO REPRESENTATIONS OR WARRANTIES THAT THE STEPS RECOMMENDED WILL ELIMINATE SECURITY OR VIRUS THREATS TO CUSTOMERS SYSTEMS. IN NO EVENT SHALL AVAYA BE LIABLE FOR ANY DAMAGES WHATSOEVER ARISING OUT OF OR IN CONNECTION WITH THE INFORMATION OR RECOMMENDED ACTIONS PROVIDED HEREIN, INCLUDING DIRECT, INDIRECT, CONSEQUENTIAL DAMAGES, LOSS OF BUSINESS PROFITS OR SPECIAL DAMAGES, EVEN IF AVAYA HAS BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES. THE INFORMATION PROVIDED HERE DOES NOT AFFECT THE SUPPORT AGREEMENTS IN PLACE FOR AVAYA PRODUCTS. SUPPORT FOR AVAYA PRODUCTS CONTINUES TO BE EXECUTED AS PER EXISTING AGREEMENTS WITH AVAYA. All trademarks identified by or TM are registered trademarks or trademarks, respectively, of Avaya Inc. All other trademarks are the property of their respective owners Avaya Inc. All Rights Reserved. Page 9